From d4078af9a7cf9fc2bb98e965dffc45128331b276 Mon Sep 17 00:00:00 2001
From: watanaby <>
Date: Sat, 21 May 2005 07:47:56 +0000
Subject: [PATCH] Initial import.
---
opengate/README | 87 +++++++
opengate/conf/opengatefw.conf | 38 +++
opengate/conf/opengatefw.pl | 75 ++++++
opengate/conf/opengatesrv.conf | 57 +++++
opengate/doc/Changes.html | 291 ++++++++++++++++++++++
opengate/doc/GPL.txt | 341 ++++++++++++++++++++++++++
opengate/doc/errcheck-e.html | 224 +++++++++++++++++
opengate/doc/errcheck.html | 223 +++++++++++++++++
opengate/doc/install-e.html | 416 +++++++++++++++++++++++++++++++
opengate/doc/install.html | 436 +++++++++++++++++++++++++++++++++
opengate/doc/progflow.html | 120 +++++++++
opengate/doc/protocol.txt | 54 ++++
opengate/doc/qa-e.html | 200 +++++++++++++++
opengate/doc/qa.html | 201 +++++++++++++++
opengate/doc/rulechk.txt | 40 +++
opengate/javahtml/Opengate.class | Bin 0 -> 2371 bytes
opengate/javahtml/Opengate.jar | Bin 0 -> 3864 bytes
opengate/javahtml/Opengate.java | 225 +++++++++++++++++
opengate/javahtml/OpengateClient.class | Bin 0 -> 3548 bytes
opengate/javahtml/en/accept.html | 55 +++++
opengate/javahtml/en/accept2.html | 47 ++++
opengate/javahtml/en/deny.html | 12 +
opengate/javahtml/en/index-ssl.html | 69 ++++++
opengate/javahtml/en/index.html | 69 ++++++
opengate/javahtml/en/topindex.html | 18 ++
opengate/javahtml/ja/accept.html | 53 ++++
opengate/javahtml/ja/accept2.html | 44 ++++
opengate/javahtml/ja/deny.html | 12 +
opengate/javahtml/ja/index-ssl.html | 65 +++++
opengate/javahtml/ja/index.html | 68 +++++
opengate/javahtml/ja/topindex.html | 17 ++
opengate/opengatesrv/Makefile | 158 ++++++++++++
opengate/opengatesrv/auth-pam.c | 146 +++++++++++
opengate/opengatesrv/auth-pop3s.c | 162 ++++++++++++
opengate/opengatesrv/auth-rad.c | 106 ++++++++
opengate/opengatesrv/comm-arp.c | 112 +++++++++
opengate/opengatesrv/comm-auth.c | 367 +++++++++++++++++++++++++++
opengate/opengatesrv/comm-cgi.c | 315 ++++++++++++++++++++++++
opengate/opengatesrv/comm-ipfw.c | 417 +++++++++++++++++++++++++++++++
opengate/opengatesrv/comm-java.c | 427 ++++++++++++++++++++++++++++++++
opengate/opengatesrv/comm-userdb.c | 49 ++++
opengate/opengatesrv/error.c | 122 +++++++++
opengate/opengatesrv/main.c | 174 +++++++++++++
opengate/opengatesrv/opengatesrv.h | 185 ++++++++++++++
opengate/opengatesrv/signal.c | 41 ++++
opengate/opengatesrv/sock_ntop_host.c | 80 ++++++
opengate/opengatesrv/tcp_connect.c | 54 ++++
opengate/opengatesrv/utilities.c | 219 +++++++++++++++++
opengate/opengatesrv/wrapper.c | 84 +++++++
49 files changed, 6775 insertions(+)
create mode 100644 opengate/README
create mode 100644 opengate/conf/opengatefw.conf
create mode 100755 opengate/conf/opengatefw.pl
create mode 100644 opengate/conf/opengatesrv.conf
create mode 100644 opengate/doc/Changes.html
create mode 100644 opengate/doc/GPL.txt
create mode 100644 opengate/doc/errcheck-e.html
create mode 100644 opengate/doc/errcheck.html
create mode 100644 opengate/doc/install-e.html
create mode 100644 opengate/doc/install.html
create mode 100644 opengate/doc/progflow.html
create mode 100644 opengate/doc/protocol.txt
create mode 100644 opengate/doc/qa-e.html
create mode 100644 opengate/doc/qa.html
create mode 100755 opengate/doc/rulechk.txt
create mode 100644 opengate/javahtml/Opengate.class
create mode 100644 opengate/javahtml/Opengate.jar
create mode 100644 opengate/javahtml/Opengate.java
create mode 100644 opengate/javahtml/OpengateClient.class
create mode 100644 opengate/javahtml/en/accept.html
create mode 100644 opengate/javahtml/en/accept2.html
create mode 100644 opengate/javahtml/en/deny.html
create mode 100644 opengate/javahtml/en/index-ssl.html
create mode 100644 opengate/javahtml/en/index.html
create mode 100644 opengate/javahtml/en/topindex.html
create mode 100644 opengate/javahtml/ja/accept.html
create mode 100644 opengate/javahtml/ja/accept2.html
create mode 100644 opengate/javahtml/ja/deny.html
create mode 100644 opengate/javahtml/ja/index-ssl.html
create mode 100644 opengate/javahtml/ja/index.html
create mode 100644 opengate/javahtml/ja/topindex.html
create mode 100644 opengate/opengatesrv/Makefile
create mode 100644 opengate/opengatesrv/auth-pam.c
create mode 100644 opengate/opengatesrv/auth-pop3s.c
create mode 100644 opengate/opengatesrv/auth-rad.c
create mode 100644 opengate/opengatesrv/comm-arp.c
create mode 100644 opengate/opengatesrv/comm-auth.c
create mode 100644 opengate/opengatesrv/comm-cgi.c
create mode 100644 opengate/opengatesrv/comm-ipfw.c
create mode 100644 opengate/opengatesrv/comm-java.c
create mode 100644 opengate/opengatesrv/comm-userdb.c
create mode 100644 opengate/opengatesrv/error.c
create mode 100644 opengate/opengatesrv/main.c
create mode 100644 opengate/opengatesrv/opengatesrv.h
create mode 100644 opengate/opengatesrv/signal.c
create mode 100644 opengate/opengatesrv/sock_ntop_host.c
create mode 100644 opengate/opengatesrv/tcp_connect.c
create mode 100644 opengate/opengatesrv/utilities.c
create mode 100644 opengate/opengatesrv/wrapper.c
diff --git a/opengate/README b/opengate/README
new file mode 100644
index 0000000..d5bd57a
--- /dev/null
+++ b/opengate/README
@@ -0,0 +1,87 @@
+This archive contains OPENGATE sources & documentations
+
+Copyright (C) 1999-2005 Yoshiaki Watanabe
+
+This program is free software; you can redistribute it and/or
+modify it under the terms of the GNU General Public License
+as published by the Free Software Foundation; either version 2
+of the License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+Email: watanaby@is.saga-u.ac.jp
+
+
+-----------------------------------------------------
+install documentation is in doc/install.txt
+-----------------------------------------------------
+
+Content of this archive
+
+README This file
+
+conf/ Configuration files
+ opengatefw.conf Script of initial firewall configuration
+ opengatefw.pl Perl script executed by opengate
+ opengatesrv.conf Configuration of authentication servers
+
+doc/ Documentation files
+ Changes.html Change log
+ GPL.txt GNU General Public License
+ install.html Instruction of installation(Japanese)
+ install-e.html Instruction of installation
+ qa.html Questions and answers(Japanese)
+ qa-e.html Questions and answers
+ errcheck.html Error checking list(Japanese)
+ errcheck-e.html Error checking list
+ progflow.html Program flow
+
+javahtml/ Client Java Applet and HTML files
+ Opengate.class Java Applet main executable file
+ Opengate.jar Java Applet archive file
+ Opengate.java Java Applet source file
+ OpengateClient.class Java Applet sub executable file
+
+ en/ HTML files in English
+ accept.html First accept message page(for Applet)
+ accept2.html Second accept message page(for potal)
+ deny.html Deny message page
+ index-ssl.html Authentication request page(in SSL)
+ index.html Authentication request page
+ topindex.html Top page displayed at firewall forward
+
+ ja/ HTML files in Japanese
+ accept.html First accept message page(for Applet)
+ accept2.html Second accept message page(for potal)
+ deny.html Deny message page
+ index-ssl.html Authentication request page(in SSL)
+ index.html Authentication request page
+ topindex.html Top page displayed at firewall forward
+
+opengatesrv/ Opengate server program source files
+ Makefile make file
+ auth-pam.c Authentication by PAM
+ auth-pop3s.c Authentication by POP3S
+ auth-rad.c Authentication by RADIUS
+ comm-arp.c Communication with ARP
+ comm-auth.c Communication with authentication systems
+ comm-cgi.c Communication with Web server via CGI
+ comm-ipfw.c Communication with IPFW
+ comm-java.c Communication with Java Applet
+ comm-userdb.c Communication with user database
+ error.c Error routines
+ main.c Main routine
+ opengatesrv.h Common header file
+ utilities.c Utilities
+ signal.c Functions of TCP/IP (By W. Richard Stevens)
+ sock_ntop_host.c Functions of TCP/IP (By W. Richard Stevens)
+ tcp_connect.c Functions of TCP/IP (By W. Richard Stevens)
+ wrapper.c Functions of TCP/IP (By W. Richard Stevens)
+
diff --git a/opengate/conf/opengatefw.conf b/opengate/conf/opengatefw.conf
new file mode 100644
index 0000000..5ee94b7
--- /dev/null
+++ b/opengate/conf/opengatefw.conf
@@ -0,0 +1,38 @@
+ # set these to your outside interface network and netmask and ip
+ oif="fxp0"
+ onet="133.49.20.0"
+ omask="255.255.252.0"
+ oip="133.49.22.5"
+
+ # set these to your inside interface network and netmask and ip
+ iif="fxp1"
+ inet="192.168.0.0"
+ imask="255.255.255.0"
+ iip="192.168.0.1"
+
+ fwcmd="/sbin/ipfw"
+
+ # divert packet to NATD ################################
+ $fwcmd add 1 divert natd ip from any to any via ${oif}
+
+ # Stop spoofing
+ $fwcmd add deny all from ${inet}:${imask} to any in via ${oif}
+ $fwcmd add deny all from ${onet}:${omask} to any in via ${iif}
+
+ # Allow from / to myself
+ $fwcmd add pass all from ${iip} to any via ${iif}
+ $fwcmd add pass all from ${oip} to any via ${oif}
+ $fwcmd add pass all from any to ${iip} via ${iif}
+ $fwcmd add pass all from any to ${oip} via ${oif}
+
+ # Allow DNS queries out in the world
+ # (if DNS is on localhost, delete passDNS)
+ $fwcmd add pass udp from any 53 to any
+ $fwcmd add pass udp from any to any 53
+
+ # Forwarding http connection from unauth client ###############
+ $fwcmd add 60000 fwd localhost tcp from ${inet}:${imask} to any http
+ $fwcmd add 60010 fwd localhost tcp from ${inet}:${imask} to any https
+
+ # Allow TCP through if setup succeeded ########################
+ $fwcmd add 60100 pass tcp from any to any established
diff --git a/opengate/conf/opengatefw.pl b/opengate/conf/opengatefw.pl
new file mode 100755
index 0000000..3968269
--- /dev/null
+++ b/opengate/conf/opengatefw.pl
@@ -0,0 +1,75 @@
+#!/usr/bin/perl
+
+### Firewall control perl script drived by opengatesrv.cgi ###
+
+($ipfwpath,$rulenumber,$clientaddr,$userid,$macaddr,$userproperty)=@ARGV;
+close STDOUT; close STDERR; close STDIN;
+
+system "$ipfwpath","-q","add","$rulenumber",
+ "allow","ip","from","$clientaddr","to","any";
+
+system "$ipfwpath","-q","add","$rulenumber",
+ "allow","ip","from","any","to","$clientaddr";
+
+
+exit 0;
+__END__
+########### Above line is the end of interpreting#############
+
+ PARAMETERS
+
+ $ipfwpath = path to ipfw command
+ $rulenumber= ipfw rule number. one number for one client
+ $clientaddr= client machine's IP address
+ $userid = user's ID. Auth server ID is attached, if entered.
+ $macaddr = MAC address for the client machine
+ $userproperty = user property acquired from user database
+ (Need to edit comm-userdb.c to use this option).
+
+ CAUTIONS
+
+*Be care to execute quickly and without delay.
+ This script runs in EXCLUSIVE mode.
+
+*Be care to add least rule set.
+ The rules are added PER each client.
+
+*Be care to eliminate bug and security hole.
+ At modification, debug it perfectly in stand along mode.
+
+*If possible, the rule should be written in rc.firewall.
+ Following can be written in rc.firewall
+ Deny some protocol though authentication passed.
+ Allow to access some server without authentication.
+
+*Following might be written in this script.
+ Deny guest users to access internal network.
+ Deny a client having specific MAC address.
+ Forward some service to proxy server after authentication.
+ (Last one might be written in rc.firewall as the rule of other
+ side interface which is not used by opengate)
+
+ SIMPLE SCRIPT
+
+If you are confused, return to the following default script.
+=====================================================
+#!/usr/bin/perl
+
+# get parameters
+($ipfwpath,$rulenumber,$clientaddr,$userid,$macaddr)=@ARGV;
+
+# close web server I/O
+close STDOUT; close STDERR; close STDIN;
+
+# allow all packets incomming to the client.
+system "$ipfwpath","-q","add","$rulenumber",
+ "allow","ip","from","any","to","$clientaddr";
+
+# allow all packets outgoing from the client.
+system "$ipfwpath","-q","add","$rulenumber",
+ "allow","ip","from","$clientaddr","to","any";
+
+exit 0;
+__END__
+======================================================
+
diff --git a/opengate/conf/opengatesrv.conf b/opengate/conf/opengatesrv.conf
new file mode 100644
index 0000000..58991fd
--- /dev/null
+++ b/opengate/conf/opengatesrv.conf
@@ -0,0 +1,57 @@
+###### authentication servers
+
+default:tc=pam
+
+cs:address=noah.cs.is.saga-u.ac.jp:protocol=pop3:
+
+pam:protocol=pam:
+
+rad:protocol=radius:
+
+ps:protocol=pop3s:address=133.49.50.3:
+
+
+# :protocol=ftp:address={|}:[port=:]
+# :protocol=pop3:address={|}:[port=:]
+# :protocol=pop3s:address={|}:[port=:]
+# :protocol=pam:[servicename=:]
+# :protocol=radius:[conffile=:]
+#
+### examples ###
+# cc:address=192.168.0.1:protocol=ftp:
+# AuthOK, if ftp request is accepted by the server.
+# Default port defined in /etc/services is used.
+#
+# cs:address=noah.cs.is.saga-u.ac.jp:protocol=pop3:
+# AuthOK, if pop3 request is accepted by the server.
+# Default port defined in /etc/services is used.
+#
+# hi:address=himiko.cc.saga-u.ac.jp:protocol=ftp:port=1111:
+# AuthOK, if ftp request is accepted by the server.
+# Specific port is used.
+#
+# ps:protocol=pop3s:address=192.168.0.10:
+# AuthOK, if pop3s (SSLed pop3) request is accepted by the server.
+# Default port defined in /etc/services is used.
+#
+# pam:protocol=pam
+# Authentication request is send to some authentication proc
+# via PAM (Pluggable Authentication Modules).
+# The configuration is described in /etc/pam.conf
+# The default servicename "openagte" is used in pam.conf.
+#
+# pmf:protocol=pam:servicename=authfirst
+# Authentication request is sent to some authentication proc
+# via PAM. The configuration is described in /etc/pam.conf
+# Specific servicename "authfirst" is used in pam.conf.
+#
+# rad:protocol=radius:
+# Authentication request is sent to RADIUS servers directly
+# (RADIUS servers can also be used via PAM).
+# The configuration is described in default config file
+# /etc/radius.conf.
+#
+# rad1:protocol=radius:conffile=/usr/local/etc/radius1.conf:
+# Authentication request is sent to RADIUS servers.
+# The coonfiguration is described in specific config file
+# /usr/local/etc/radius1.conf
diff --git a/opengate/doc/Changes.html b/opengate/doc/Changes.html
new file mode 100644
index 0000000..7ec7a22
--- /dev/null
+++ b/opengate/doc/Changes.html
@@ -0,0 +1,291 @@
+
+
+
+
+
+
Opengate History
+
+
+
Ver.0.10 at 1999.8.30
+
+Scratch Version. In this version, Java applet is sent first, and the applet accept password.
+
+Ver.0.11 at 1999.9.19
+
+Stable Version. Reform program.
+
+Ver.0.12 at 1999.11.2
+
+Support firewalls IPF and ipfw.
+
+Ver.0.20 at 1999.9.16
+
+Abandoned version.
+
+Ver.0.30 at 1999.10.16
+
+Change to accept password with CGI. IPF support is disarded.
+
+Ver.0.31 at 1999.10.26
+
+Reform User Interface. Java applet shows own window.
+
+Ver.0.32 at 1999.11.1
+
+Support IPF.
+
+Ver.0.33 at 2000.6.17
+
+Support IP forwarding. Discard IPF support.
+
+Ver.0.40 at 2000.6.19
+
+Support multiple authentication servers.
+
+Ver.0.41 at 2000.6.23
+
+Add fuction to close firewall, when no packet passed for a while.
+
+Ver.0.42 at 2000.6.28
+
+Add function to close firewall at abnormal server termination.
+
+Ver.0.50 at 2000.12.11
+
+Add fuction to exchange hello message with terminal. Firewall is closed, when the client does not reply. Java output is included in html window.
+
+Ver.0.51 at 2000.12.22
+
+Support pop3 authentication.
+
+Ver.0.52a at 2001.1.19
+
+Exclusive execution of ipfw command.
+Deny multiple authentication requests from a terminal.
+Change the method to get Java connection address.
+Modify string sizes in the program.
+Many small modifications.
+
+Ver.0.52b at 2001.1.24
+
+Reform unp library.
+
+Ver.0.52c at 2001.1.26
+
+Add DEBUG flag. Modify Directory setting.
+
+Ver.0.52d at 2001.1.30
+
+Modify no packet time setting.
+
+Ver.0.52e at 2001.2.5
+
+Correct mistake comment.
+
+Ver.0.53a at 2001.2.7
+
+Directory setting is integrated in Makefile.
+Support logging MAC address.
+
+Ver.0.53b at 2001.2.8
+
+Add the check of null userID or password.
+
+Ver.0.53c at 2001.2.10
+
+Replace one accept window to two overlapped windows.
+
+Ver.0.53d at 2001.2.13
+
+Small modification on MAC address acquisition.
+
+Ver.0.54a at 2001.2.15
+
+Serious error(Ports are wasted in long execution) found and fixed.
+
+Ver.0.55a at 2001.3.19
+
+Show messages on JavaApplet field.
+
+Ver.0.56a at 2001.3.29
+
+Detach unp library (Many modifications in source)
+
+Ver.0.56b at 2001.4.14
+
+Modify document.(No modification in source)
+
+Ver.0.56c at 2001.4.24
+
+Reform HTML to improve authentication response time.(Modification in accept.html)
+
+Ver.0.56d at 2001.4.29
+
+Declaration of GPL. Add English documentations.(No modification in source)
+
+Ver.0.57a at 2001.5.10
+
+Remove loop at ipfw-delete. (Modification in comm-ipfw.c)
+
+Ver.0.57b at 2001.5.11
+
+Change Lockout time for ipfw exec. (Modification in opengatesrv.h)
+
+Ver.0.57c at 2001.5.25
+
+Put out message at Java/JavaScript disabled. (Modification in accept.html)
+
+Ver.0.57d at 2001.11.21
+
+Change timeout values (Modification in opengatesrv.h)
+
+Ver.0.57e at 2002.2.13
+
+Care for redirect error on IE (Modification in topindex.html)
+
+Recover error messages added in Ver.0.57c but forgotten in Ver.0.70a (Modifications: accept.html)
+
+Ver.0.73c at 2002.7.12
+
+Changes in some documents
+
+Ver.0.73d at 2002.7.15
+
+More careful detaching from web server. (Modifications: main.c comm-cgi.c)
+
+Ver.0.73e at 2002.8.7
+
+Fix a serious bug in java applet entered at Ver.0.70a. The applet did not return hello to hello request in english message mode.(Modifications: Opengate.java)
+Save index.html created at web server installation. (Modifications: Makefile)
+
+Ver.0.80a at 2002.8.19
+
+Add perl script for more flexible firewall control(Modifications: main.c comm-ipfw.c opengatesrv.h Makefile, Additions: conf/opengatefw.pl)
+Fix a small mistake at debug mode (Modifications: auth-pam.c)
+Modify installation procecure. Opengate directory can be set in Makefile(Modifications: Makefile, *.html). Add document to describe the system flow (Additions: doc/progflow.html).
+
+Ver.0.80b at 2002.8.26
+
+Fix a bug at checking overlapped request (Modifications: comm-ipfw.c)
+
+Ver.0.81a at 2002.8.26
+
+Add link to close network available at No-java mode (Modifications: accept.html, Makefile, comm-cgi.c, comm-java.c, main.c ,opengatesrv.h)
+
+Ver.0.81b at 2002.8.27
+
+Remove userid from terminate link string (Modifications: comm-cgi.c, comm-java.c), Modify accept page design (Modifications: accept.html)
+
+Ver.0.81c at 2002.9.5
+
+Version up is mistaked. Removed.
+
+Ver.0.81d at 2002.9.9
+
+Fix a mistake about URL string in a HTML file. (Modifications: ja/accept.html)
+Remove reference HTML document from archive. Add description about maxuser=0 in installation document.
+
+Ver.0.81e at 2002.9.10
+
+Add checking for execl failure (Modifications: comm-ipfw.c, comm-arp.c, main.c)
+
+Ver.0.82a at 2002.9.25
+
+Add skeleton routine to get user property (Modifications: opengatesrv.h, Makefile, main.c, comm-ipfw.c, opengatefw.pl, Additions: comm-userdb.c)
+
+Ver.0.83a at 2002.10.7
+
+Permit no reply to hello more than one time (Modifications: comm-java.c, opengatesrv.h)
+
+Ver.0.83b at 2003.1.6
+
+Add documentation about maximum number of TCP connections (Modifications: install.html, install-e.html)
+
+Ver.0.90a at 2003.5.6
+
+Add duration input field in auth page for the demand of long usage without java. To cope with hijacking and notting, mac-address and packet-count are checked periodically. (Modifications: index.html, index-ssl.html, accept.html, comm-cgi.c comm-java.c, comm-arp.c, main.c, opengatesrv.h)
+
+Ver.0.90b at 2003.5.7
+
+Reset the DEBUG option. It was misset in the previous version.(Modification: opengatesrv.h)
+
+Ver.0.90c at 2003.5.15
+
+Simplify the logic.(Modification: comm-java.c)
+
+Ver.0.90d at 2003.8.27
+
+Change message in auth page.(Modification: index.html, index-ssl.html)
+
+Ver.0.90e at 2003.9.24
+
+Display (firewall-rule-Number,userID,IPaddress) in process title.(Modification: main.c)
+
+Fix PAM-include error occured on FreeBSD 5 (Modification: auth-pam.c)
+
+Ver.0.90h at 2003.12.8
+
+Fix Applet-NoReply error occured on some browsers at removing applet page. Modify install document (Modification: Opengate.java and the compiled files, install.html,install-e.html)
+
+Fix communication error occured in some pop3/pop3s server (Modification: comm-auth.c, auth-pop3s.c)
+
+Ver.0.90k at 2005.2.3
+
+Add links in accept.html to cope with popup-blocked and java-optional browser (Modification: accept.html)
+
+Ver.0.90l at 2005.2.4
+
+Fix communication error with ftpserver sent back multi-line greeting. Add error reporting code at fork/exec (Modification:comm-auth.c, comm-ipfw.c)
+
+Ver.0.90m at 2005.2.7
+
+Add error check code for ipfw response (Modification:comm-ipfw.c)
+
+Ver.0.90n at 2005.3.21
+
+Add no-cache option in authentication pages (Modification:index.html, index-ssl.html)
+
+Ver.1.0.0 at 2005.5.21
+
+Stable version is released (Modification;README)
+
+
+
diff --git a/opengate/doc/GPL.txt b/opengate/doc/GPL.txt
new file mode 100644
index 0000000..b830682
--- /dev/null
+++ b/opengate/doc/GPL.txt
@@ -0,0 +1,341 @@
+ GNU GENERAL PUBLIC LICENSE
+ Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+ 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+ Preamble
+
+ The licenses for most software are designed to take away your
+freedom to share and change it. By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users. This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it. (Some other Free Software Foundation software is covered by
+the GNU Library General Public License instead.) You can apply it to
+your programs, too.
+
+ When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+ To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+ For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have. You must make sure that they, too, receive or can get the
+source code. And you must show them these terms so they know their
+rights.
+
+ We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+ Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software. If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+ Finally, any free program is threatened constantly by software
+patents. We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary. To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+ The precise terms and conditions for copying, distribution and
+modification follow.
+
+ GNU GENERAL PUBLIC LICENSE
+ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+ 0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License. The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language. (Hereinafter, translation is included without limitation in
+the term "modification".) Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope. The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+ 1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+ 2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+ a) You must cause the modified files to carry prominent notices
+ stating that you changed the files and the date of any change.
+
+ b) You must cause any work that you distribute or publish, that in
+ whole or in part contains or is derived from the Program or any
+ part thereof, to be licensed as a whole at no charge to all third
+ parties under the terms of this License.
+
+ c) If the modified program normally reads commands interactively
+ when run, you must cause it, when started running for such
+ interactive use in the most ordinary way, to print or display an
+ announcement including an appropriate copyright notice and a
+ notice that there is no warranty (or else, saying that you provide
+ a warranty) and that users may redistribute the program under
+ these conditions, and telling the user how to view a copy of this
+ License. (Exception: if the Program itself is interactive but
+ does not normally print such an announcement, your work based on
+ the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole. If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works. But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+ 3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+ a) Accompany it with the complete corresponding machine-readable
+ source code, which must be distributed under the terms of Sections
+ 1 and 2 above on a medium customarily used for software interchange; or,
+
+ b) Accompany it with a written offer, valid for at least three
+ years, to give any third party, for a charge no more than your
+ cost of physically performing source distribution, a complete
+ machine-readable copy of the corresponding source code, to be
+ distributed under the terms of Sections 1 and 2 above on a medium
+ customarily used for software interchange; or,
+
+ c) Accompany it with the information you received as to the offer
+ to distribute corresponding source code. (This alternative is
+ allowed only for noncommercial distribution and only if you
+ received the program in object code or executable form with such
+ an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it. For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable. However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+ 4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License. Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+ 5. You are not required to accept this License, since you have not
+signed it. However, nothing else grants you permission to modify or
+distribute the Program or its derivative works. These actions are
+prohibited by law if you do not accept this License. Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+ 6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions. You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+ 7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all. For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices. Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+ 8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded. In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+ 9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time. Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation. If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+ 10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission. For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this. Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+ NO WARRANTY
+
+ 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+ 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+ END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Programs
+
+ If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+ To do so, attach the following notices to the program. It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+
+ Copyright (C)
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+ Gnomovision version 69, Copyright (C) year name of author
+ Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+ This is free software, and you are welcome to redistribute it
+ under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License. Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary. Here is a sample; alter the names:
+
+ Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+ `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+ , 1 April 1989
+ Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs. If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library. If this is what you want to do, use the GNU Library General
+Public License instead of this License.
+
diff --git a/opengate/doc/errcheck-e.html b/opengate/doc/errcheck-e.html
new file mode 100644
index 0000000..df0a76d
--- /dev/null
+++ b/opengate/doc/errcheck-e.html
@@ -0,0 +1,224 @@
+
+
+Opengate Error Check
+
+
+
+
+
+
+
Opengate Error Check
+
+
+As opengate interacts with many software, it is diffcult to recognize the behavior. Then this memo is prepared to assist debug.
+
+When error occured, check the stand alone action of each related software. Especially setting of ipfw is difficult and affects to many sides. At first, debug with ipfw fully open state. Then close it little by little.
+
+Opengate uses following files, where the directorys are default. Is these files correctly settled.
+
+
+
+Following are the checking list for debugging.
+
+
Japanese characters in html and java files cannot be understood.
+
+
+
Html sample files in English are saved in sub directory. Java messages are described in program comments.
+
+
+
Compiler tells the lack of librarys or headers.
+
+
+
Opengate after Ver.0.56 can be compiled on FreeBSD Ver.4.1.
+
+
+
+
Cannot redirect web access to gateway machine.
+
+
+
Opengatesrv.cgi is not yet loaded in this moment.
+
+
Try to access opengate URL directly. If no response is returned, check the setting of Apache and HTML document directory. Check the Apache access log and Apache error log.
+
+
Check default directory of Apache document. It may be different to this document.
+
+
Check ipfw setting. Rule number of foward command must be larger than opengate rule numbers.
+
+
If error occurs only when accessing sub page(not top page), [PageNotFound] setting in Apache httpd.conf may not be correct.
+
+
In Microsoft Internet Explorer 5 or later, redirection to a page at [PageNotFound] cannot be done, when the size of the page is less than 512Bytes. Try to increase the size of the top page file larger than 512Bytes by adding space chacters. Reference http://support.microsoft.com/default.aspx?scid=kb;EN-US;q218155.
+
+
Does the web access pass through the gateway? Only the packet passing through the gateway is redirected.
+
+
Try to access by IP address. If domain name is not recognized, check the DNS setting.
+
+
The top page cannot be settled under SSL.
+
+
+
+
Cannot jump to authentication page.
+
+
+
Many ADDRESS descriptions in HTML files must be changed to your site.
+
+
Try manual jump. If sccess, check jump description of html.
+
+
Try non SSL setting. If success, check about SSL.
+
+
URL in authentication page must be described with full/absolute pass.
+
+
+
+
No reply or error reply to posting userID and password.
+
+
+
At this moment, [opengatesrv.cgi] is loaded.
+
+
The authentication page cannot be the top page. Set up some top page from which authentication page is jumped.
+
+
Check processes by [ps ax]. If [opengatesrv.cgi] is not loaded, check the directory of CGI and URL description in html file. Check Apache setting about CGI enable and CGI directory.
+
+
If [opengatesrv.cgi] is loaded, check [/var/log/opengate.log]. Set [#define DEBUG 1] in [opengatesrv.h] for debug output to syslog.
+
+
Check the firewall rule for the accessed terminal by entering [ipfw list]. Ipfw command requires root permission. Check [opengatesrv.cgi] has root permission.
+
+
Check [opengatesrv.h] and [Makefile]. Does the settings match to the positions of files?
+
+
Check applet insertion mark in [accept.html]. Does it match to the [#DEFINE] in [opengatesrv.h]?
+
+
Check setting of web browser. Is Java Enabled?
+
+
Check with other web browsers or other OSs. Error may be caused by browser's bug.
+
+
Check the directory of Java Applet. Does it recognized by web server? Does the Java Applet run normally.
+
+
Change the host description in [opengatesrv.conf] from domain name to IP address. If success, an error may occur in the name resolution.
+
+
+
+
Access is rejected, even though I send correct password.
+
+
+
Check [/var/log/opengate.log].
+
+
Check [opengatesrv.conf]. Is the setting correct? The file must ended with return key.
+
+
Try to access from gateway console to the authentication server. Does the server reply normally?
+
+
Opengate assumes that the welcome message of FTP server is only one line. If the server puts out multiple lines, change the server setting or the routine in opengatesrv. Opengate(Ver.0.90l) is modeified to communicate such servers.
+
+
If the client is already opened, the request form same client is rejected. Check the firewall state by accessing outside. At mulfunction of JavaApplet, the server side program waits for Java Applet connection, and closes firewall after fixed duration.
+
+
+
+
The accept page is displayed and the network is opened. But the network is closed after a while.
+
+
+
If userID is not shown in the yellow frame layouted in the page, Java Applet loading might be failed. Check the setting relating Java. Standard instalation of Netscape6 and InternetExplorer6 does not include JavaVM. At accessing Java page, download of JavaVM is requested. Please follow the messages. If it does not work, try other browser or other version. Some browser in some version cannot run Java Applet well. It might work after installation of SunJava2.
+
If userID is shown, check message displayed by Java Applet. It might be caused by following.
+(1)No connection request comes from Java Applet. (2)No reply to hello message comes from Java Applet. (3)No packet from/to the terminal is passed through the gateway for a while. (4) Java Applet is terminated by unknown cause. (5)Server process is terminated by unknown cause.
+
At no connection from Java Applet, the network is closed in the following cases. (1)The duration entered in auth page is passed. (2)No packet from/to the terminal is passed through the gateway for a while. (3)Arp command replys the different MAC address. (4)The TERMINATE link in accept page is clicked.
+
+
+If internet connection firewall(ICF) in WindowsXP is enabled, the connection is closed in some condition, but we cannot identify the condition. If occured, disable the firewall.
+
+
+In some browser, the connection was closed when the java applet page is removed. The behavior is dissolved in version 0.90h.
+
+
Check [/var/log/opengate.log].
+
+
Check above notes relating Java. Check network state with [netstat] or other tools. Check message displayed on web browser.
+
+
If address translation system such as NAT or Proxy is inserted between the terminal and the gateway, opengate cannot work normally.
+
+
+
+
Accept page may be not normal.
+
+
+
In normal state, 2pages are displayed. In the first page, java Applet layouts yellow frame and shows user ID. In the second page, some links and cautions are displayed.
+
If the yellow frame is not shown, Java Applet might not work normally. Check the items above.
+
Second page is started by JavaScript. Check the javaScript setting at mulfunction. The second page exists only for convenience and is not needed for network control. If the window.open is denied only by Internet Explorer, the setting of the browser might corrupt. Reffer http://support.microsoft.com/support/kb/articles/q180/1/76.asp It is occured in IE6 also.
+
+
+
+
The network is opened without authentication.
+
+
+
Check the application in client(terminal) machine. Is the web browser really terminated? For example,in MacOS, application can be resident in hidden state. In some OS, the application is resident forever. In this case, Java Applet is needed to modify such as adding close button.
+
+
When the network is cut off or the terminal system is suddenly terminated, TCP close signal cannot be sent to gateway. Thus detection is delayed until next message exchange.
+
+
When ipfw rule is failed to be removed, permanently open state is occured. In such case, remove the rule manually or reboot the system. After Ver.0.90e, a script can remove the rules failed to remove at terminating the process.
+
+
+
+
Accept page is displayed, but the network is closed.
+
+
+
Check ipfw rule with command [ipfw list]. Is the rule sequence correct?
+
+
Check [/var/log/opengate.log].
+
+
If redirect page does not include [NoCache] setting, the cached page is loaded responding to the another access. For example, if yahoo access is redirected to the opengate page, another yahoo access loads the cached opengate page, even if the network is opened.
+
+
+
+
I sent correct password, but denied.
+
+
+
Check the authentication server by sending request from console.
+
Check the description in opengatesrv.conf, radius.conf and pam.conf.
+
Check [/var/log/opengate.log].
+
+
+
+
Displayed page is not my desired language.
+
+
+
Check index.html, its directory and Makefile. These language IDs must be same The ID is case sensitive and is two bytes length.
+
If you want to add new language, add new directory and files. Then add its ID in makefile.
+
+
+
+
Network troubles increased after the installation of this soft.
+
+
+Please use latter versions. Do not use before Ver.0.54 which includes a serious bug.
+
+
+
+
Sometimes, there are very long response time (60sec or more) for authentication request.
+
+
+Please discover the part waisting long time. We experienced following case. The setting "HostnameLookups" in httpd.conf is "On", and DNS servers do not have sufficient informations about clients. Then, very long time is wasted in name lookup. The trouble is canceled by setting the above switch "Off".
+
+
+
All is checked. I cannot know what to do.
+
+
+
Set [#define DEBUG 1] in [opengatesrv.h]. Program tracing is put out in syslog.
+
Insert [err_msg()] in proper place in the program to get debug print. The function put out message to syslog. The sample usage exists in the program. Format is same as [printf()].
+
Microsoft Internet Explorer 5È~ÍA_CNgæÌy[Wª512oCgÈãÅÈ¢ÆAPageNotFoundÌ_CNg\¦ª¤Ü¢«Ü¹ñBgbvy[WÉóðSoCgÇÁµÄÝľ³¢BQlîñÍhttp://www.microsoft.com/japan/support/kb/articles/JP218/1/55.aspÅ·B
+
+
Tuning of network setting
+
+This section is needed when you apply this software to an environment
+where many clients are connected.
+In such case, modification is recommended about the following two values.
+
+kern.ipc.somaxconn
+ Maximum number of TCP connections(default=128).
+ As Opengate server keeps TCP connection with each terminal,
+ the number must be set larger than the number of terminals.
+
+kern.ipc.nmbclusters
+ Maximum number of mbuf clusters (1cluster=2KB). It needs "send/recv
+ buffer size(default=32KB)" x "number of connections".
+ The usage statistics is shown by "netstat -m".
+
+For example, these values are set as follows.
+Be care about the memory size for mbuf (following setting needs 128MB).
+
+Add two lines in the file "/etc/sysctl.conf".
+ kern.ipc.somaxconn=4096
+ kern.ipc.nmbclusters=65536
+
+ * Check the installation carefully and be familiar with these softwares.
+Debugging is confused, if these softwares are incomplete.
+
+
+
Setup related softwares
+
+
+
Modify /etc/rc.conf
+
+gateway_enable="YES" <==If NATD is not used
+firewall_enable="YES"
+firewall_type="simple"
+natd_enable="YES" <==If NATD is used
+natd_interface="fxp0" <== ", the name must be matched to your interface.
+
+
+
Modify /etc/rc.firewall
+
+The file /etc/rc.firewall is the default firewall script.
+The script file can be changed as [firewall_script="/etc/xxxx"] in rc.conf.
+
+When [firewall_type="simple"], the firewall rules matched to [simple] is loaded.
+
+
+Example description in /etc/rc.firewall.
+Be care that rules matched to [simple] are distributed in the file.
+Check the real setting by the command [ipfw list].
+The sample setting is not the ideal.
+Refer to the default rc.firewall and edit it properly.
+
+[Ss][Ii][Mm][Pp][Ll][Ee])
+ # set these to your outside interface network and netmask and ip
+ oif="fxp0"
+ onet="133.49.20.0"
+ omask="255.255.252.0"
+ oip="133.49.22.5"
+
+ # set these to your inside interface network and netmask and ip
+ iif="fxp1"
+ inet="192.168.0.0"
+ imask="255.255.255.0"
+ iip="192.168.0.1"
+
+ # divert packet to NATD ################################
+ $fwcmd add 1 divert natd ip from any to any via ${oif}
+
+ # Stop spoofing
+ $fwcmd add deny all from ${inet}:${imask} to any in via ${oif}
+ $fwcmd add deny all from ${onet}:${omask} to any in via ${iif}
+
+ # Allow from / to myself
+ $fwcmd add pass all from ${iip} to any via ${iif}
+ $fwcmd add pass all from ${oip} to any via ${oif}
+ $fwcmd add pass all from any to ${iip} via ${iif}
+ $fwcmd add pass all from any to ${oip} via ${oif}
+
+ # Allow DNS queries out in the world
+ # (if DNS is on localhost, delete passDNS)
+ $fwcmd add pass udp from any 53 to any
+ $fwcmd add pass udp from any to any 53
+
+ # Forwarding http connection from unauth client ###############
+ $fwcmd add 60000 fwd localhost tcp from ${inet}:${imask} to any http
+
+ # Allow TCP through if setup succeeded ########################
+ $fwcmd add 60100 pass tcp from any to any established
+
+
+Caution
+
+Rule number for [forward] Command must be larger than the rule numbers used
+in opengate(10000-40000).
+
+Rule number for [divert to natd] must be smaller than most rules.
+
+The file [conf/opengatefw.conf] is the script describing the above rules.
+You can edit and use this script instead of rc.firewall.
+
+
Check the action of ipfw
+
+Check the firewall state by the command "ipfw list".
+By using ipfw command, add / delete the pass rules for a client(xx.xx.xx.xx) and check the network open / close for the client.
+
+
+ ipfw add 10000 allow ip from xx.xx.xx.xx to any <===Open outgoing
+ ipfw add 10000 allow ip from any to xx.xx.xx.xx <===Open incoming
+
+ ipfw del 10000 <===Close
+
+Be falimiar with ipfw command.
+Opengate is a software to send out the ipfw command like above one.
+
+
Modify /usr/local/etc/apache/httpd.conf
+
+Web access control
+
+order deny,allow
+deny from all
+allow from 133.49.0.0/255.255.0.0 (Example, need to change address)
+allow from 192.168.0.0/255.255.0.0
+
+local1.* /var/log/opengate.log
+ --Separated by TAB key
+
+
+
Make log file.
+
+touch /var/log/opengate.log
+
+
+
+
Expand the archive file: opengatexxx.tar.gz
+
+ tar zxvf opengatexxx.tar.gz
+ (where xxx is the version. Use latest one)
+
+Then, the following directorys are created. Check the files.
+Change the setting if you want(Most setting can be modified after installation).
+
+ doc: Documentations
+ conf: configuration file sample, firewall control perl script sample
+ javahtml: Client Java Programs and HTML files.
+ opengatesrv: Server CGI program
+
+
+
Java setup: compile javahtml/Opengate.java, if jar file is not found.
+
+ javac Opengate.java
+ jar cvf Opengate.jar *.class
+
+
Make Opengateserver
+
+ cd opengatesrv : Move to opengatesrv directory
+ edit Makefile : Modify Makefile (parameters are described below)
+ **HOSTADDR must be changed to IP address of your
+ machine's client side interface.**
+ edit opengatesrv.h : Modify header file(parameters are described below)
+ make : Compile
+ su : Change to Root
+ make install : Install
+
+
Modify /etc/opengatesrv.conf
+
+Authentication server is indexed by opengatesrv.conf.
+The format is one of the following. Multiple servers can be set.
+("[..]" means optional, "|" means OR.)
+
+
+ID:Identification keyword for the authentication server.
+address: IP address(or domain name) of the authentication server.
+protocol: protocol for authentication,
+ At present, ftp,pop3,pop3s,radius,pam are available.
+port: port number for authentication. If ignored, follows to /etc/services.
+conffile: path to config file at RADIUS. default is "/etc/radius.conf".
+servicename: service name at PAM. default is "opengate".
+
+Examples of opengatesrv.conf
+
+*This is a simple example.
+
+In this case, the user is checked by FTP accessing to the address xx.xx.xx.xx.
+At first, check the basic installation by the setting like this.
+
+ default:tc=as
+ as:address=xx.xx.xx.xx:protocol=ftp:
+ (FTP access to address xx.xx.xx.xx must be checked in advance)
+
+
+
+*Following example sets four authentication servers.
+If the user entered as [userID] in userID field, authentication is turned to [default(=cs)] server.
+If entered as [userID@cc], authentication turned to [cc] server.
+If entered as [userID@pam], authentication turned to [pam] server.
+If entered as [userID@rad], authentication turned to [rad] server.
+
+
+*If protocol=pam is defined, you must setup [/etc/pam.conf] or [/etc/pam.d/opengate].
+Opengate checks auth and account.
+
+Following is an example setting in /etc/pam.conf.
+
Opengate action check
+1)Access to some external URL from client web browser.
+2)If authentication page is displayed,
+enter userid and password registered in auth server.
+3)If accept page is displayed, access external URL.
+4)If the external page is displayed, terminate the browser.
+5)Reload browser and access to external URL.
+6)If the authentication page is displayed, you complete the basic installation.
+
+Errors
+At 2) Try to access the Opengate server URL.
+If success, check ipfw fwd rule.
+If not, check www/data directory setting.
+At 3) Try authentication server access(eg. ftp xx.xx.xx.xx) from command line.
+If success, check opengatesrv.conf.
+If not, check access control and user registration in auth server.
+At 4)Check firewall setting with ipfw command.
+At 6)Try other URLs.
+If success, the first page is loaded from browser's cache.
+If not, check the firewall setting.
+*More debuging documentation exists in other file.
+
+
Html setup: change javahtml/++/*.html, if you want to modify message.
+ Html documents are prepared for each languages (eg; ja en)
+
+ topindex.html : first html which describe the auto-jump to Authentication page.
+ index.html : Authentication page
+ deny.html : page sent at authentication denyed.
+ accept.html,accept2.html : pages sent at authntication accepted.
+ Don't remove mark "**OpengateAppletHere**", where
+ Java Applet description is inserted.
+ %%HOSTADDR%% is replaced with address at installation.
+ %%OPENGATEDIR%% is replaced with install directory.
+
+
Firewall control script
+
+If USEFWSCRIPT=0, CGI execs ipfw command directly. In this case, the
+all packets from/to the authenticated client is allowed. If 1, perl
+script controls the ipfw command. By editting opengatefw.pl, flexible
+control can be done. Be care to maintain it simple for better
+performance and security. The script runs under exclusive mode.
+Insertion of time comsuming logics may result in less performance.
+
+If you want to control firewall state with some user property in a
+database, edit the skeleton routine comm-userdb.c to send property to this script.
+
+
Parameteres in Makefile
+
+
+HOSTADDR = IP address of gateway interfaced to client network.
+HTMLTOP1 = Web top directory
+HTMLTOP2 = Web top directort (for SSL)
+OPENGATEDIR = Opengate install directory (from Web top)
+CGIPATH = CGI directory
+CGIPROG = CGi program name
+CONFIGFILE = Configuration file name
+USEFWSCRIPT= Enable(1) or disable(0) Perl script to control firewall open
+FWSCRIPT = Firewall control Perl script name
+FWSCRIPTPATH = Perl script path
+LOCKFILE= Lock file for exclusive execution
+HTMLDOCS= HTML files listing
+DENYDOC = HTML file sent at denying
+ACCEPTDOC = HTML file sent at accepting
+HTMLLANGS= Languages of HTML files
+ARPPATH= Path to arp command
+IPFWPATH= Path to ipfw command
+
+
+
Parameters in opengatesrv.h
+
+
+ DEBUG : If set to 1, function call trace log is put out to syslog.
+
+ DURATIONDEFAULT : Default time duration to wait for Java Applet connect.(second)
+ If no connection in the duration, the network is closed.
+ The duration can be changed in auth page by the user.
+
+ DURATIONMAX : Maximum duration to wait for Java Applet connect. (second)
+ Under this value, the Applet waiting duration (= duration of
+ network open without Java Applet) can be specified by the user
+ on the authentication page.
+ If user specified duration is not agreeable, set it the same
+ value as DURATIONDEFAULT and remove the field in auth page.
+
+ ACTIVECHECKINTERVAL : Time interval of checking the terminal.(second)
+ In no java mode, check by MAC address and packet count for the
+ terminal's IP address.
+ In java mode, check by HELLO exchange and packet count.
+
+ COMMWAITTIMEOUT : Server waiting time for communication reply.(second)
+
+ NOREPLYMAX : Permitted count of no reply to HELLO. If the client does not
+ send back HELLO more than NOREPLYMAX times, then the network
+ is closed.
+
+ NOPACKETINTERVAL : If no packet is passed for this time interval, then
+ the network is closed.(second)
+
+ LOCKTIMEOUT : Maximum locking time for exclusive ipfw action.(second)
+
+ IPFWMIN : Minimum ipfw rule number used by opengate.
+ IPFWMAX : Maximum ipfw rule number used by opengate.
+ IPFWINTERVAL : Rule number interval used by opengate.
+ The maximum terminals/processes can be controled by these value.
+
+ PORTMIN : minimum port value used by opengate.
+ PORTMAX : maximum port value used by opengate.
+ Set unused port range.
+
+ FACILITY : syslog facility
+
+ PAMSERVICENAME : default service name at PAM.
+ RADIUSCONF : default path to radius.conf.
+
+
+[Ss][Ii][Mm][Pp][Ll][Ee])
+ # set these to your outside interface network and netmask and ip
+ oif="fxp0"
+ onet="133.49.20.0"
+ omask="255.255.252.0"
+ oip="133.49.22.5"
+
+ # set these to your inside interface network and netmask and ip
+ iif="fxp1"
+ inet="192.168.0.0"
+ imask="255.255.255.0"
+ iip="192.168.0.1"
+
+ # divert packet to NATD ################################
+ $fwcmd add 1 divert natd ip from any to any via ${oif}
+
+ # Stop spoofing
+ $fwcmd add deny all from ${inet}:${imask} to any in via ${oif}
+ $fwcmd add deny all from ${onet}:${omask} to any in via ${iif}
+
+ # Allow from / to myself
+ $fwcmd add pass all from ${iip} to any via ${iif}
+ $fwcmd add pass all from ${oip} to any via ${oif}
+ $fwcmd add pass all from any to ${iip} via ${iif}
+ $fwcmd add pass all from any to ${oip} via ${oif}
+
+ # Allow DNS queries out in the world
+ # (if DNS is on localhost, delete pass DNS)
+ $fwcmd add pass udp from any 53 to any
+ $fwcmd add pass udp from any to any 53
+
+ # Forwarding http connection from unauth client ###############
+ $fwcmd add 60000 fwd localhost tcp from ${inet}:${imask} to any http
+ $fwcmd add 60010 fwd localhost tcp from ${inet}:${imask} to any https
+
+ # Allow TCP through if setup succeeded ########################
+ $fwcmd add 60100 pass tcp from any to any established
+
+ ipfw add 10000 allow ip from xx.xx.xx.xx to any <===MJú
+ ipfw add 10000 allow ip from any to xx.xx.xx.xx <===óMJú
+
+ ipfw del 10000 <===½
+
+
+Following is the flow of the Opengate system.
+
+
+
+
+An user on the client machine accesses to some URL such as
+ [eg., http://www.some.site/ or http://www.some.site/some/path]
+
+
+Ipfw in gateway checks the packet passing though the gateway. For
+packets from closed client, the forward rule as [ipfw add 60000 fwd
+localhost tcp from 192.168.0.0/16 to any http] is applied.
+
+
+The web server in localhost(gateway) receives the packet as [GET / or
+/some/path]
+
+
+The /index.html file is returned in both cases, because the httpd.conf
+ is set as [ErrorDocument 404 /index.html]
+
+
+The browser receives /index.html. But the browser misunderstands
+that the reply is returned from www.some.site.
+
+
+To remove the misunderstanding, the /index.html jumps to full URL
+description of gateway as [META HTTP-EQUIV="Refresh" CONTENT="0;
+URL=http://192.168.0.1/opengate/en/index.html"]
+
+
+The returned page /opengate/en/index.html is the authentication request page.
+The browser understands the site of this page correctly.
+
+
+The user enters userid and password to this page, and clicks button to
+call Opengate CGI [FORM METHOD="POST"
+ACTION="/cgi-bin/opengate/opengatesrv.cgi"].
+
+
+The CGI starts and processes the following.
+
+
+CGI gets the userid[eg., user1 or user1@id1], password, IP
+address[eg., 192.168.0.111], and MAC address.
+
+
+CGI reads configuration file[opengatesrv.conf] and gets the
+information about the authentication server[default(if @xx is not
+entered) or id1].
+
+
+CGI sends userid[user1] and password to the authentication server.
+
+
+After passing the authentication, CGI inserts firewall rule before the
+forward rule [ipfw add 10000 allow ip from 192.168.0.111 to any] and
+[ipfw add 10000 allow ip from any to 192.168.0.111]. The rules
+indicate the pass of packet to/from the client. At the insertion, CGI
+searchs an unused rule number[eg., 10000] and uses. The perl script
+can be modified, if more flexible ipfw control is desired.
+
+
+CGI reports to syslog that the firewall is opened
+[Jun 16 19:14:11 ... OPEN: user user1 from 192.168.0.111...].
+
+
+CGI reads reply page file [accept.html], inserts specific information
+[userid, server address and port] and sends it to the client. The page
+describes the dowloading of java applet [applet
+code='Opengate.class'...] and the opening of second page
+[window.open("http://.../accept2.html")].
+
+
+CGI closes STDOUT to terminates the web server process.
+
+
+CGI waits for the java applet to connect.
+
+
+If no connection in DURATIONDEFAULT seconds, CGI removes the firewall rule
+{ipfw del 10000] and terminates. (If duration is entered in auth page, the time is extended to the time. To cope with hijacking and notting, periodical execution of arp command and firewall packet inquiry.)
+
+
+If connected, CGI watchs the TCP connection linking between gateway and client.
+ If the TCP connection is closed, CGI removes the firewall rule and terminates.
+
+
+CGI sends 'hello' to the client every ACTIVECHECKINTERVAL seconds.
+ If no reply in HELLOWAITTIMEOUT seconds, CGI removes the firewall rule and terminates.
+
+
+CGI gets number of passed packets for inserted rule from firewall
+[ipfw -a list 10000] every ACTIVECHECKINTERVAL seconds. If the packet
+count does not increase in NOPACKETINTERVAL seconds, CGI removes the
+firewall rule and terminates.
+
+
+At termination, CGI reports to syslog the filewall close [Jun 16
+22:11:55 ... CLOS: user user1 from 192.168.0.111...].
+
+
+There are many incidents such as computer cracking or copyright infringement in the network. The organization might be caughted by many troubles caused by such incidents. In these cases, it is needed to identify the related person. The other reason is the restriction required by payment or aim of the network
+
+
+
Why don't you use the authentication function inherent in the terminal?
+
+
+Unified system can depend on such function. But it cannot be applied to the open network envoronment where various hardwares and users are connected with various formats, such as wireless connection of his/her own portable PC.
+
+
+
+Why do you try to authenticate at client site? Is the authentication at server site essential?
+
+
+Yes it is essential. But to prevent trouble occured by unknown user of your site, authentication and usage log systems are required.
+
+
+
+Why does the target include open-use terminal that is settled by the organization for open usage? It can be protected by the system software.
+
+
+It is difficult for network control section to maintain many terminals distributed in wide campus. Moreover there are already various terminals settled by various sections. Some do not have such function and some are leaved with no control.
+
+
+
+Why don't you use the log obtained at gateway or firewall?
+
+
+The log does not include user identification.
+
+
+
+What is the merit compared with the identification by MAC address.
+
+
+The cost might be large to maitain the matching between user and MAC address.
+
+
+
+What is the merit compared with various authentication systems for network usage proposed recently.
+
+The merits of Opengate are as follows. Wide applicability about terminals, such as its hardware, software, management and connection. Minimum cost for user guidance and management. Easy implementation to existing network. Quick open at start usage and quick close at stop usage.
+
+
+
+Is there any other application of the system?
+
+For example, it might be used as the gateway from intra-net to extra-net or the contrary.
+
+
+
+What to do for No Java terminals?
+
+The no Java user can enters the usage duraion in auth page. To cope with hijacking and notting, the connection state is checked periodically by ARP command and packet count passing the firewall. The user can also close the network by clicking the TERMINATE link in accept page.
+
+
+
+
+
+
+
+Usage
+
+
+Is the system compatible with wireless LAN?
+
+
+Yes. But do not use the host station having NAT.
+
+
+
+Can the system coexists with NAT or DHCP.
+
+
+Yes. But do not insert NAT between the server and client.
+
+
+
+Can the MAC address be obtained?
+
+Yes. But the address is restricted to the one aquired from server on ethernet.
+
+
+
+I want to supply some services without authentication, or I do not want to supply some services even after authentication.
+
+
+The both can be realized by firewall rule set.
+
+
+
+I want to separate the commission range by the user rank.
+
+
+Firewall can be controled by Perl script. If the user rank is discriminated with userID pattern, authentication server, or IP address, it might be done. The function is added in Ver.0.80.
+
+
+
+I want manage temporal users.
+
+
+It is needed to register to an authentication server. As the system comminucates with plural servers, you can make specific server for temporal users and maintain it.
+
+
+
+Can the password secret be maintained?
+
+
+Yes. Communication between client and opengate server can be protected by SSL. Communication between opengate server and authentication server can be protected by secure auth protocol.We implement pop3s, radius, and pam(which supports many secure protocols).
+
+
+
+How are the scalability and performance?
+
+
+We are using the system in environments including active 50 or above terminals.
+
+
+
+Installation and Development
+
+
+I meet bugs on installation.
+
+
+See other document.
+
+
+
+Am I permited to use, modify or distribute the program?
+
+
+Yes it is permitted under GPL.
+
+
+
+Can I modify the web page design.
+
+
+As the web pages are described in html files, it is easy to modify the design.
+
+
+
+
+Can I avoid atacks such as IP spoofing or DoS(Denial of Service)?
+
+
+IP spoofing has no merit, because the system permits the address from which user information sended. DoS can be avoided, because each client uses different port in the system.
+
+
+
+Why the archive file is disorder?
+
+
+Sorry. I am trying to order.
+
+
+
+Can the server run on other OSs than FreeBSD.
+
+
+No. The system uses ipfw command which is specific to FreeBSD. The ipchains command in Linux can be used instead of ipwf.
+
+
+
+It is not smart that many processes resident. Can these be integrated to one process?
+
+
+Yes. But in the present version, we take priority on simplicity of program.
+
+
+
+
+Is the system compatible with IPv6?
+
+
+It might be realized by controlling both ipfw and ip6fw. But, in ipv4/IPv6 dual stack state, it is not so easy to get all IP addresses for the requested terminal. Thus, it is not yet programmed.
+
+For the present, following method might be the solution, though there is a restriction. Modify the ipfw control script opengatefw.pl as to allow IPv6 packet from/to the requested terminal's MAC address. The method can be used when the gateway and the terminal stay in the same ethernet link.
+
+If your computer does not have Java VM, access
+here to download.
+
+
+
+
+You will be disconnected when you stop your WEB browser.
+Do not forget to stop your WEB brower when you finish to use the network.
+
+
+If you are using user terminals in University Library, please close
+all windows by "CLOSE" in "FILE" menu at the upper left corner of the
+window.
+
+
+
+If your name does not appear, short time usage is permitted. In this case, you should click HERE to close the network (No need to click, when your name appears above).
+
+
+
+
+
+
diff --git a/opengate/javahtml/en/accept2.html b/opengate/javahtml/en/accept2.html
new file mode 100644
index 0000000..8ed1c11
--- /dev/null
+++ b/opengate/javahtml/en/accept2.html
@@ -0,0 +1,47 @@
+
+
+
+Opengatemain
+
+
+You are authenticated. You can use the network.
+
+
+Your authentication is valid until you quit your browser.
+Do not forget to stop your WEB brower when you finish to use the network.
+
+
+If you are using user terminals in University Library, please close
+all windows by "CLOSE" in "FILE" menu at the upper left corner of the
+window.
+
You are requested to be authenticated before using network.
+
+
+
You will be authenticated with your user ID and
+password for systems in Computer and Network Center (CNC). If you do
+not know your user ID and/or password, please consult CNC.
+
+
+
+Please enter your user ID and password in the box below, then press
+SEND.
+
+
+
+
+
+
+
+
+
+
+
If you have some questions, please contact CNC.
+
+
November 2000
+
+ CNC (Computer and Network Center)
You are requested to be authenticated before using network.
+
+
+
You will be authenticated with your user ID and
+password for systems in Computer and Network Center (CNC). If you do
+not know your user ID and/or password, please consult CNC.
+
+
+
+Please enter your user ID and password in the box below, then press SEND.
+Please use SSL Authentication as far as possible to prevent wiretapping.
+